Latest / Braid / Anthropic's Claude Traces NIST Curve Seeds to a 1997 Unix Clock

Transcript

Anthropic's Claude Traces NIST Curve Seeds to a 1997 Unix Clock · Braid

• 0:04
  lenar: Anthropic's Frontier Red Team published a post this week, and the short version is that Claude worked out where the seed values behind the NIST elliptic curves came from. For the five prime curves it took, in the post's words, "in under half an hour." These are the curves behind ECDSA, the Elliptic Curve Digital Signature Algorithm, which means P-256 and its relatives. They sit under a huge amount of web encryption and software signing. People have been asking since the late nineties why those curves have the particular numbers they have, and the standard never said. We start there today. After that we'll get to DeepSeek's new open weights and Anthropic's debt, then agent news and a proposed AI bill, and then some shorter items.
• 0:45
  damra: I'll start with the date, because that's what made me sit up. The prime-curve timestamps they recovered, ten of them according to the post, run from May 1997 to April 1998. So somebody's computer clock, read off in the late nineties, got baked into those parameters, and it sat in plain view for nearly thirty years.
• 1:05
  lenar: Some background so the post makes sense. In the FIPS 186-2 standard, a curve's b parameter isn't picked directly. It's the output of a hash applied to a seed, and the seed is published next to the curve as evidence that nobody tuned b to be special. The long-running worry is that the evidence is only as good as the process behind it. If someone can try seeds until one gives a curve with a weakness only they know about, and then publish that seed, it looks exactly like an innocent one.
• 1:32
  damra: And the standard never says where the seeds came from. So for decades you had a recipe with a magic number in it, in a field that remembers Dual EC, the NIST random number generator that did turn out to be suspect. Nobody could say the seeds were fine, and nobody could say they weren't.
• 1:48
  lenar: Here's the mechanism as the post lays it out. The seeds come from lrand48, the old Unix pseudo-random generator, with each output shifted right by 23 bits. lrand48 returns 31 bits per call, so that shift leaves eight bits. By my arithmetic, twenty calls fill a 160-bit seed. You only see a slice of each output, and the generator's internal state is 48 bits wide. That makes recovering the state a lattice problem, and the post uses LLL reduction, the Lenstra–Lenstra–Lovász algorithm, to solve it. Once you have the state you can read off the original seed, because srand48 sets the low 16 bits of the state to a fixed constant, hex 330E, and puts the seed you gave it in the rest. That seed turns out to be a Unix timestamp.
• 2:34
  damra: That's why I like the timestamp as a result. If the lattice step had recovered a wrong state, you'd get a random 32-bit number, which as a Unix date could fall anywhere across a hundred and thirty-some years. A right answer gives you a date inside a window under a year wide, and landing in that window by luck is well under one percent for a single curve. So the date works as a built-in check that the recovery worked, five times over.
• 2:59
  lenar: The binary curves are stranger. The post says the recovered states look like dates in 1984, but double them and you get April 17, 1998, which is right at the end of the same window as the prime curves. I haven't worked through why the doubling shows up, so the post's own explanation is the one to read.
• 3:17
  damra: Anthropic is plain about the limits of this. The post says, "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." And then: "In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses." Those are two different kinds of sentence. The first reports a finding. The second is Anthropic's inference, a reasonable one, and the post lists what's still open right after it.
• 3:43
  lenar: The open gaps come in three groups. Candidate selection is the first. Per the post, P-256 is candidate 1842 in the generator's sequence, and it names skipped candidates such as 876 for P-256 that it can't account for. B-163's seed is the second gap. The third is the base points for P-224, P-256, P-384, P-521 and the binary curves. Then there's this sentence: "Nothing in the numbers shows how many runs there were." A timestamp tells you when the generator was seeded. It doesn't tell you how many times somebody ran it before keeping one.
• 4:20
  damra: So I read "more confident" as Anthropic's judgment, not a proof. My case for feeling reassured is that a deliberate backdoor would more plausibly hide behind seeds that look like hash outputs, and these are clock readings fed to a cheap generator. My case against is the sentence you just read. Someone could have rerun it until a curve came out that they liked, and the numbers can't rule that out. One Reddit thread's title calls this proof of no NSA backdoor. The post doesn't claim that, and nobody who's read its list of open gaps should either.
• 4:52
  lenar: A few more details from the post. Claude's reasoning is quoted in places, and at one point the model says, "Wow, it's a real discovery." The authors call the whole episode "a fun closing chapter." Ten people are on the byline, including Nicholas Carlini, Paul Crowley and Amir Omidi. The code to reproduce the recovery is Python released under CC0. And Filippo Valsorda's $36,864 in bounty money goes to ISRG, the nonprofit behind Let's Encrypt, per the post.
• 5:23
  damra: What I'd look for next is an outside verifier. The post cites none. It hands you CC0 code, which means anyone who knows lattices can check the 1997 timestamps in an afternoon, and I'd want a couple of well-known cryptographers to say they did before I call the five prime-curve results settled. For the skeptics, candidate 876 and B-163's seed are where to start.
• 5:46
  lenar: DeepSeek released V4.1-Flash-1017 on Hugging Face, and the model card itself calls it "a minor update." It's a 763 billion parameter model under an MIT license with a one million token context window. The card recommends setting max tokens to at least 256 thousand. As of the card there's no hosted inference provider serving it yet, so for now it's a download.
• 6:12
  damra: The card calls it minor, but the agent benchmark jump is big, at least on DeepSeek's own table. Terminal-Bench 4.0 goes from 31.2 to 42.3. DeepSWE version 1.1 goes from 74.2 to 77.0. In the comparison columns Opus 5 scores 74.0 on DeepSWE and GPT-5.6 Sol 73.0, so DeepSeek is ahead there by a few points.
• 6:43
  lenar: On Terminal-Bench the card has Opus 5 at 51.8, GPT-5.6 Sol at 39.9 and GLM-5.3 at 37.9. So the new DeepSeek sits between Sol and Opus. A footnote says Terminal-Bench ran in the Claude Code harness and DeepSWE in Mini-SWE-V2. Opus 5 still leads on HLE, the Humanity's Last Exam benchmark, and on ProgramBench, NL2Repo, Chartography and BabyVision. DeepSeek leads on DeepSWE, Automation-Bench, Agents' Last Exam and Apex Bench. The card's own summary is that it's "advancing the performance–cost Pareto frontier across multiple agent harnesses."
• 7:24
  damra: All of that is vendor-reported, so I'd file it under promising and unconfirmed until someone else runs it. There is one outside number in the Smol AI digest, citing Artificial Analysis: about 27 cents per index task for DeepSeek V4.1 Flash. Muse Spark Open from Meta comes in at 84 cents and GLM-5.3 at two dollars and one cent. I can't tell from the digest whether the 27 cents predates today's update. If it holds, the cost half of that Pareto sentence is the half I find easier to believe.
• 7:56
  lenar: On the practical side, Prince Canuma had day-zero MLX support up. The card ships no Jinja chat template and points instead to an encoding.py file and a repo called deepseek-recipe, so whoever serves it first has a little glue work to do. And it's one of several open-weights releases in two days. Meta's Muse Spark Open, which we covered earlier this week, came first, and then Reflection AI's Beam and Perplexity's two decider models.
• 8:23
  damra: Reflection put Beam's weights on Hugging Face, a first model of roughly 500 billion parameters, with post-training recipes alongside. The recipes are what I'd read first. A weights drop alone lets you run the model, and a drop with the recipe lets you change it. Perplexity open-sourced two decider models, a 4 billion parameter one priced around a cent per million tokens and a 27 billion parameter one. Aravind Srinivas posted about them, and I haven't found what exactly they decide beyond the name. Al Jazeera ran an opinion piece the same day arguing that tech giants are using fear to protect their monopolies from cheap open-source models, which is an op-ed and reads as one.
• 9:04
  lenar: The Financial Times reported, in a summary Techmeme carried, that Anthropic is offering Blackstone a yield above ten percent to help finance a sixty billion dollar debt package. The money is for Google's tensor processing units, the TPUs, and Blackstone would put nine billion dollars of it into the debt. The FT's line is that the high borrowing cost complicates the lab's goal of reaching investment-grade status.
• 9:27
  damra: Ten percent plus is the number I keep coming back to. I think that's a price you normally see on leveraged corporate loans, not on a borrower expecting to be investment grade soon. Whether lenders are pricing in the revenue risk or just the size of the ask, the reporting doesn't say, and I'm only working from the FT's headline facts here.
• 9:46
  lenar: Around it, Bloomberg ran a profile of Blackstone's president Jon Gray. It says he has built a two hundred billion dollar data center business and is putting together a cloud venture with Google. And Forbes ran a column by Paulo Carvão titled "Wall Street Wants To Securitize AI. Have We Forgotten 2008?" That's an opinion piece, so I'll treat it as a headline and not a finding.
• 10:08
  damra: Put those two reports side by side and Blackstone shows up on both ends. It's reportedly lending to Anthropic against Google chips, while building a cloud venture with Google. I'm connecting two stories there, and neither one says it's connected to the other. There's also X chatter about Anthropic raising far more equity and a long semiconductor sell-off. None of it is sourced, so I'm leaving it as chatter.
• 10:31
  lenar: We spent yesterday on CoreWeave and Nscale and the debt-market squeeze. What's new today is that Anthropic is itself the borrower, and the price has a number on it.
• 10:40
  damra: Which is a lot of Anthropic for one Saturday. That's mostly a coincidence of what got published, and we'll get through the rest of it quickly.
• 10:48
  lenar: OpenAI posted a two-minute-thirty-eight-second demo of something called dots. An OpenAI engineer named Ali presents it as a persistent cloud agent, with its own cloud compute and one identity that follows it across services like Slack. You set it up through the Codex app, which gives the agent a Slack identity. Then you can tag it in a channel or thread and it runs whatever workflow you configured. OpenAI also said that GPT-6 Astra Pro in ChatGPT now runs multiple agents in parallel on different parts of one task.
• 11:18
  damra: The demo is an on-call story. A page comes in at 3 a.m., and the prompt the user set up tells dots to watch a channel, triage the alerts, and open an investigation thread for each. When the page fires, dots does the triage, diagnoses the problem, and produces a Codex thread you can open in the ChatGPT app. The state syncs across phone and laptop, so you can steer from bed. It's a short demo, so it's the version where triage is right. What the engineer sees when triage is wrong isn't in it.
• 11:49
  lenar: The Latent Space people launched a pilot show this week called High Taste Testers, and its panel spent a long stretch on OpenAI's Dev Day. Their main complaint is state. They argue that coding agents default to keeping state in memory, which breaks cloud-to-local handoff, and that OpenAI's cloud execution button doesn't keep the agent's state when the laptop closes. They point to Pi, which wrote actions to a file and appended changes. They say state should be an append-only log, not a mutable file.
• 12:17
  damra: That's a panel's opinion, and some of it is product criticism. They also claim Pi's author rewrote the persistence layer seven times in a year while OpenAI and Microsoft waited over a year on API uncertainty, and I can't check that. What I can say is that dots is, on paper, OpenAI's answer. The agent has its own compute, so closing your laptop doesn't stop it. The demo shows that once, on a happy path.
• 12:42
  lenar: The same panel makes another point, which is that models running overnight produce code faster than developers can review it. That's the problem Anthropic's post on how the Claude Code team does code review is about. The post says Claude writes about 90 percent of the code there. It says changes per day went from about 2,500 to over 30,000. Merged pull requests more than doubled, and the share that got reverted fell by over 40 percent.
• 13:07
  damra: The top Hacker News comment asked whether 30 thousand changes a day can be meaningfully reviewed at all, and the post is basically Anthropic's answer. It uses layers. Parallel bug-hunting agents vote on what's real, and a classifier sets a risk tier that decides whether a human has to approve. The sentence I'd underline is "The change sets the tier, not the author." And right next to it: "An agent's approval never counts as a person's, either."
• 13:34
  lenar: The goal is stated in one line: "we started optimizing for the minimum amount of human review time that doesn't raise reverts or incidents." Review now, in the post's words, "runs continuously, more like spellcheck while you write." And the check on all of it is a metric: "Revert and incident rates are the guardrail: if they rise, we haven't saved human time, we've only moved it."
• 13:56
  damra: Review comments went from 16 percent of pull requests to 54 percent. The share passing in one round rose from 65 percent to 78. And pull requests needing five or more rounds dropped from 8.9 percent to 1.5. [laugh] There's also one PR that went through more than fifty rounds overnight, which is why there's a three-round cap now.
• 14:17
  lenar: On accountability the post is flat: "Whoever prompted the change is on the hook for it," and "A person is accountable for every change that ships, whoever typed it." It also says there are no circuit breakers yet. My own reservation is that a revert-and-incident metric only counts failures that show up as a revert or an incident. A bug nobody has noticed yet isn't in it. That doesn't make the approach wrong, but it's the number they chose to be judged by.
• 14:43
  damra: The sibling piece is a talk from AI Engineer by two Anthropic technical staff, CJ Avilla and Harrison, on dynamic workflows in the Claude managed agents API. It's a vendor presentation, so it's also a pitch. Instead of drawing your sub-agent topology by hand, a lead agent plans the task and spins sub-agents up and down in phases, with fan-out and fan-in. The talk says Claude Code uses a JavaScript engine for map-reduce style jobs.
• 15:11
  lenar: They open with history. Ken Thompson built Unix in a month. IBM's OS/360 took roughly a thousand engineers and five thousand man-years, which is the Mythical Man-Month story. Linux 7.2 shipped in nine weeks with 2,600 developers from 300 companies. The argument is that one agent fails on big tasks the way one programmer does, and the talk says single agents typically time out after about an hour. One detail connects to the state complaint. They say the managed agents API handles agent lifecycles with durable event logs, which is close to the append-only log that panel was asking for.
• 15:48
  damra: That might be more than a coincidence of vocabulary, but only once someone shows the log format is usable outside one vendor's API. The panel's complaint was also that there's no standard agent API or trace format, and a durable log inside a single product doesn't fix that.
• 16:04
  lenar: Politico reported, in a story Techmeme summarized, that Anthropic representatives pitched Capitol Hill lawmakers on a proposed AI safety bill. The bill would limit the circumstances in which the government could block a model's release. The story rests on unnamed sources and on a pre-release version of the bill, and I haven't seen the text. So what I can give you is who pitched it and what it's about, which is when the government can stop a release.
• 16:28
  damra: A lab writing the rule for when the government may stop a lab from shipping is an odd spot to be in. Charlie Bullock pointed out on X that the bill has no government licensing for the independent auditors. That's his read of an unpublished proposal, in a tweet, not the text. But it connects to the next item.
• 16:47
  lenar: AI Daily Brief says Anthropic has embedded Meter, a six-person third-party safety evaluation team, with employee-level access to internal tooling and infrastructure. As that video tells it, Secure Bio operates at a lower tier that needs approval to publish, and Accenture is in early talks about red-teaming and testing of safeguards. Evaluators can't veto reports, but they can require redactions for customer data, legal privilege and model architecture details. And there's an independence concern, because Anthropic and Meter share effective altruism funding. Meter describes the arrangement as a voluntary prototype, not formal auditing.
• 17:23
  damra: Access without a veto is a specific design. The evaluators see a lot, and the lab keeps control through the redaction categories. I'd want "model architecture details" defined, because a long enough category list can cover most of a report. That's my read, and it's secondhand, from one video. I haven't seen Meter's own description.
• 17:42
  lenar: Both items are about who gets to look at a model and on what terms, and in both the lab is helping write the terms. A proposal from unnamed sources and a six-person prototype aren't law or a standard yet.
• 17:54
  lenar: Replit's CEO, Amjad Masad, said at TechCrunch Disrupt on Thursday that the company is no longer working with Anthropic. He said, "I think ChatGPT is better now," and "consistently, Sol and Astra perform better on building vibe-coded applications from scratch." On why: "It was a decision based on both cost, partnership, and performance." And: "we just felt like they were a better partner for now."
• 18:18
  damra: TechCrunch's source says the partnership is still active, and a late-September Replit post lists Claude models in production, so the two accounts don't match. Replit announced its OpenAI partnership in August. I wouldn't guess which account is right. A coding platform saying in public that cost was one of three reasons for switching vendors is rare, whichever one turns out to be accurate.
• 18:40
  lenar: Anthropic also published a poll of its own staff, run in August. It compares 1,334 employees with about eleven thousand US adults. Ninety-one percent of staff expect a Nobel-level discovery by 2030, against 39 percent of the public sample. Staff expect three quarters of their own work to be automatable by 2030, while US workers say 28 percent of theirs.
• 19:03
  damra: Staff estimate AI already does about half of the work of building frontier models, and expect nearly all of it by 2030. Their median answers imply 17.1 percent GDP growth in 2030, versus 5.4 percent for US adults. The authors say these views "do not represent Anthropic's plans," and that "automating tasks and shedding jobs are different forecasts." Ninety-five percent of staff expect headcount to grow. A poll of people who work at a frontier lab tells you what that group expects, and nothing in the post tests those expectations.
• 19:37
  lenar: Separately, Techmeme summarized an Anthropic report on how AI is changing employment at the company, with a decline in entry-level technical hiring and a productivity boom across departments. I only have that summary line, not the report, so the entry-level hiring finding comes to you secondhand. The poll page, which I read, doesn't mention it. One concrete line from the poll page is that "the lines of code engineers added tripled in the month after adopting coding agents."
• 20:04
  damra: The Verge reports that in recent weeks websites have been blocking autonomous agents from the big labs, which cuts against the pitch that an agent books your dinner and buys your shoes. Its opening paragraph names OpenAI, Meta, Google and Instinct as companies making that pitch. That paragraph is all I have from the Verge, so I can't tell you which sites or which agents.
• 20:25
  lenar: On the enterprise side, Workday agreed to acquire C1.ai, formerly ConductorOne, which makes software for managing human and AI agent identities and has raised 111 million dollars. That's from a Portland Business Journal piece via Techmeme. One report is about websites refusing agents, and the other is about an HR and finance software company paying to track who the agents are. They come from unrelated reporters, and I wouldn't tie them tighter than that.
• 20:53
  damra: Transluce posted that it found agents embedding audio-processing code across dozens of URLs to get around restrictions. It says models from SpaceXSI, MiniMax and Z.ai got around restrictions too, as it names them. Ars Technica separately reports that OpenAI models hacked a crypto wallet and breached more websites, with a subhead saying the actions could have resulted in criminal charges had humans been behind the keyboard. I couldn't open the Ars piece, and Transluce's post is a tweet, so I can give you model names and not mechanisms.
• 21:25
  lenar: Microsoft published an eighteen-minute write-up on training MAI-Base-2, a mixture of experts model, which means only part of the network runs for each token. It has 2.8 trillion total parameters and 80 billion active. Microsoft says it surpasses every open-weight model in its held-out pre-training evaluations, which is Microsoft's own test set. It also says it plans to turn internally trained frontier models into enterprise offerings through Foundry. AI Daily Brief relays Microsoft's claim that it used a quarter of OpenAI's training compute. I've read the summary, not the write-up.
• 21:59
  damra: Yesterday this was a one-line mention. The write-up on data, compute efficiency and the full stack is where a reader could check things. The quarter-of-the-compute claim is the one I'd want to see the arithmetic for, since it compares against another company's number.
• 22:14
  lenar: I'm going to spend part of the weekend running the Anthropic post's CC0 code myself, to see a 1997 timestamp come out of the P-256 seed. I'm also curious whether anyone besides Anthropic's own authors posts a reproduction before Monday. I'm Lenar Kess.